Support request-scoped PAC child environments

[Eric Lott (pa911-eric)]

Summary

PAC authentication profiles and token-refresh state are machine/user-scoped. Concurrent PAC operations under different customer identities can therefore select or clear one another's profiles on a shared host.

This change gives hosts a request-scoped PAC child environment and removes client-secret state from Node's process-global environment. Hosts can use the supplied runtime helper to give each request a disposable PAC profile/cache root.

Changes

• Add optional pacEnvironment overrides to RunnerParameters.
• Snapshot request environment overrides when a command runner is created.
• Preserve inherited environment variables while applying request-scoped overrides.
• Add createPacRuntimeEnvironment for disposable profile/cache roots.
• Add withPacRuntimeEnvironment and withPacRuntimeParameters for guaranteed cleanup and safe RunnerParameters integration.
• Keep PAC_CLI_SPN_SECRET scoped to PAC child processes and clear it after pac auth clear.
• Retry cleanup for older PAC builds that leave telemetry directories briefly after exit.
• Add tests for overlapping runners, environment snapshots, cleanup success/failure, path-safe prefixes, and parameter merging.

This PR does not claim that PAC officially documents profile-directory overrides. Hosts must validate the PAC version they deploy and retain an appropriate fallback when isolation is not honored.

Validation

• npm test: 84 passing.
• Compile and lint pass.
• PAC 2.4.1: 64 concurrent isolated auth list processes passed with zero leftovers.
• PAC 1.43.6: 64 concurrent isolated auth list processes passed with zero leftovers after cleanup retries.
• Wrapper-level authenticated-flow simulation: 128 concurrent request scopes passed with zero cross-request state and zero leftovers.
• The original two-tenant shared-profile control race reproduced identity mismatches, while the normal PAC profile remained unchanged after isolated runs.

The in-house mutex fallback is intentionally kept outside this wrapper PR because it is host policy for PAC versions that fail the isolation smoke test.

[Eric Lott (pa911-eric)]

Pausing upstream submission while we complete local fork validation. The implementation remains available on the fork branch.

[Eric Lott (pa911-eric)]

@microsoft-github-policy-service agree